Home / Privacy Policy
Privacy and Personal Data Protection Policy
1. General information
This Privacy Policy describes how the personal data of visitors to the official website of the Thassos Tourism Promotion and Development Organisation (the “Organisation”) is collected, used and protected.
Personal data is processed in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and applicable Greek law.
Data Controller
Thassos Tourism Promotion and Development Organisation
Registered office: Thassos, 640 04, Greece
Contact email: thassostourismorg@gmail.com
Technical management and support
The website is developed, managed and supported technically by INTERAD S.A., which works with the Organisation and processes personal data on its behalf, within the scope of the services assigned to it.
For any matter relating to personal data protection, data subjects may contact the Organisation at the email address above.
2. What personal data is
Personal data is any information relating to a natural person whose identity is known or can be established, directly or indirectly.
Such information may include a person’s full name, email address, IP address and other details that allow a natural person to be identified.
3. What personal data is collected
The website is institutional and informational in nature. Browsing its publicly available content does not require registration or creating a user account.
Personal data is collected and processed in the following cases.
3.1. Contacting the Organisation
When a visitor chooses to contact the Organisation through the contact form, the following information is collected:
- Full name
- Email address
- Message content
The information is used to receive, review and respond to the enquiry, and for any related correspondence that may be necessary.
Submitting the form is the visitor’s own initiative and does not mean subscribing to a mailing list or consenting to receive newsletters.
3.2. Optional subscription to the mailing list
The website offers the option of voluntarily registering an email address on the Organisation’s mailing list.
The purpose of registering is to make it possible to send future updates, announcements and news about the Organisation’s activities and initiatives.
Subscription is based on the consent of the data subject and is independent of the use of the contact form.
Subscribers may withdraw their consent at any time and ask for their address to be removed from the list by contacting the Organisation.
3.3. Technical operation and security data
When visiting the website, technical data necessary for its proper and secure operation may be collected and processed.
This data may include the IP address, browser details, device information and access or technical event logs.
3.4. Visitor statistics
The website uses Google Analytics to collect and analyse data on its traffic and use.
This data is used to assess how the website performs and to improve its content and the browsing experience.
The related analytics cookies are activated only with the visitor’s consent, through the cookie management tool.
Further information is available in the Cookie Policy.
4. Purposes and legal bases of processing
The Organisation processes personal data for specific and lawful purposes, in accordance with Article 6 of the GDPR.
Contacting the Organisation
The purpose of processing is to receive, handle and respond to enquiries submitted by data subjects on their own initiative.
Processing is carried out on the legal basis applicable to each enquiry, depending on its subject and the nature of the Organisation’s activities.
Mailing list subscription
The purpose is to register and keep the email address in order to send future newsletters.
The legal basis is the consent of the data subject, in accordance with Article 6(1)(a) of the GDPR.
Technical operation and security
The purpose is to ensure the proper operation of the website, protect its information systems and prevent unauthorised access or malicious use.
Processing is carried out on the applicable legal basis under Article 6 of the GDPR.
Visitor statistics analysis
The purpose is to monitor website traffic and improve the website’s operation and content.
The legal basis is the visitor’s consent, in accordance with Article 6(1)(a) of the GDPR.
5. Recipients of personal data
Access to personal data is limited to authorised staff of the Organisation, solely to the extent required to perform their duties.
For the technical operation, hosting and support of the website, data may be processed by external partners providing the relevant services on behalf of the Organisation.
These partners include INTERAD S.A., which provides technical management and support services for the website.
Access to and processing of data by external partners takes place within the scope of the services assigned to them, with the required protection measures and contractual obligations in place.
Personal data may also be processed by providers of technology services used on the website, such as Google Analytics and embedded content services.
The Organisation does not sell or make visitors’ personal data available for commercial purposes.
6. Transfer of data outside the European Economic Area
The use of certain third-party services, such as Google Analytics and embedded content services, may involve the processing or transfer of personal data outside the European Economic Area.
Any such transfers are made in accordance with the requirements of the GDPR and with the appropriate mechanisms and safeguards provided for by applicable law.
7. Personal data retention period
Personal data is kept for a period appropriate to the purpose of processing and to any legal retention obligations.
In particular:
- Contact form data is kept for as long as necessary to review and handle the enquiry, and to keep the necessary record of the related correspondence.
- Mailing list email addresses are kept for as long as the data subject’s consent remains valid and the purpose of processing continues to exist, subject to any legal obligations.
- Technical data and logs are kept according to the operational and security needs of the website.
- Analytics data is kept according to the settings applied in the relevant service.
Once the retention period expires, the data is deleted or anonymised, unless further retention is required by applicable law.
8. Rights of data subjects
Under the GDPR, every natural person has the following rights, subject to the conditions of applicable law:
- Right to information and access: To be informed about the processing of their personal data and to request access to it.
- Right to rectification: To request the correction of inaccurate personal data or the completion of incomplete personal data.
- Right to erasure: To request the erasure of their personal data, where the conditions laid down by law are met.
- Right to restriction of processing: To request the restriction of processing, in accordance with the relevant provisions of the GDPR.
- Right to object: To object to the processing of personal data, in the cases provided for by law.
- Right to data portability: To receive the data they have provided in a structured, commonly used and machine-readable format, where this right applies.
- Right to withdraw consent: To withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise these rights, data subjects can contact the Organisation at the following email address:
The Organisation reviews such requests and responds in accordance with the procedures and deadlines set out in the GDPR.
9. Right to lodge a complaint
Every data subject has the right to lodge a complaint with the Hellenic Data Protection Authority if they believe that the processing of their personal data infringes applicable law.
Hellenic Data Protection Authority
Website: www.dpa.gr
10. Embedded content and third-party services
The website may include embedded content or links to external services, such as YouTube, digital maps and social media.
Using these services may involve the processing of personal data by the respective providers, in accordance with their own personal data protection policies.
Where enabling such services requires non-essential cookies or similar technologies, the visitor’s prior consent is required.
Further information is available in the website’s Cookie Policy.
11. Security measures
The Organisation ensures that appropriate technical and organisational measures are in place to protect personal data, according to the nature and risks of the processing.
These measures aim to protect data against unauthorised access, loss, alteration, destruction or unlawful disclosure.
12. Changes to this Privacy Policy
The Organisation reserves the right to update this Privacy Policy when the website’s features, its personal data processing procedures or the requirements of applicable law change.
The current version is always published on the Organisation’s website.